Examkin

Question

Difficulty: Very hardAmazon ECS and Docker Deployment

A developer is configuring a backend worker application to run on Amazon ECS using the AWS Fargate launch type. The application code running inside the container needs to read and write items in an Amazon DynamoDB table. The container image is hosted in a private Amazon ECR repository located in a separate, central shared AWS account. Additionally, the task definition retrieves sensitive database credentials stored in encrypted AWS Systems Manager Parameter Store parameters and injects them as environment variables at task startup. Which of the following configuration steps are required to successfully deploy the task and run the application? (Select TWO.)

  1. Assign an IAM role as the Task Role that contains a policy granting dynamodb:GetItem and dynamodb:PutItem permissions on the target DynamoDB table.Answer
  2. Assign an IAM role as the Task Execution Role that contains policies granting ssm:GetParameters and kms:Decrypt permissions, and configure the central ECR repository policy to allow ECR pull actions for this role.Answer
  3. C
    Assign an IAM role as the Task Execution Role that contains a policy granting dynamodb:GetItem and dynamodb:PutItem permissions on the target DynamoDB table.
  4. D
    Attach a policy to the Task Role granting ssm:GetParameters and kms:Decrypt permissions to enable the containerized application to pull the environment variables at launch.
  5. E
    Configure the trust relationship of the Task Execution Role to allow the central ECR repository's service principal ecr.amazonaws.com to assume the role.

Answer

To successfully deploy and run the application, you must assign an IAM role as the Task Role with DynamoDB access policy, and assign another IAM role as the Task Execution Role with SSM Parameter Store and KMS decryption permissions, while updating the central ECR repository policy to allow cross-account pulls.
The correct options are: assigning an IAM role as the Task Role with DynamoDB permissions, and assigning an IAM role as the Task Execution Role with SSM Parameter Store and KMS permissions alongside ECR cross-account repository access. This correctly separates the runtime application permissions (Task Role) from the container startup and orchestration permissions (Task Execution Role).

Step-by-Step Solution

1
Differentiate application-level and container-level permissions.
Identify that accessing DynamoDB is an application action, which requires permissions on the Task Role. Pulling the Docker image and retrieving configuration secrets at startup are agent-level actions, which require permissions on the Task Execution Role.
ECS separates permissions between what the container agent needs to boot the task (Task Execution Role) and what the running application needs (Task Role).
2
Configure permissions for accessing DynamoDB.
Create a policy allowing dynamodb:GetItem and dynamodb:PutItem on the target table, and attach it to the Task Role.
The code running inside the container utilizes the credentials provided by the Task Role at runtime.
3
Configure permissions for pulling the cross-account ECR image.
Update the repository policy in the central AWS account to allow the task execution role of the application account to perform pull actions (ecr:BatchGetImage, ecr:GetDownloadUrlForLayer).
Cross-account ECR pulls require both the puller to have IAM permissions and the ECR repository to explicitly trust the cross-account principal.
4
Configure permissions for SSM Parameter Store secrets resolution.
Attach policies allowing ssm:GetParameters and kms:Decrypt on the KMS key to the Task Execution Role.
Using the valueFrom syntax in the task definition instructs the ECS agent to fetch and decrypt the parameters at task creation time before launching the container.

Key Concept

Delineating responsibilities and permissions between the ECS Task Role and the ECS Task Execution Role for Fargate deployments.
Rate this question

Topics

Amazon ECS and Docker Deployment

More questions from this topic